mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 06:55:30 +00:00
Code Issues Releases Wiki Activity

allow dlz to signal that the view's transfer acl should be used

Browse Source
This commit is contained in:
Mark Andrews
2019-01-02 17:29:59 +11:00
parent 76085b7e9c
commit a520662ed4
7 changed files with 61 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/dns/dlz.c
View File

@@ -133,11 +133,17 @@ dns_dlzallowzonexfr(dns_view_t *view, const dns_name_t *name,
view->rdclass, name, clientaddr, dbp);
/*
* if ISC_R_NOPERM, we found the right database but
* the zone may not transfer.
* In these cases, we found the right database. Non-success
* result codes indicate the zone might not transfer.
*/
if (result == ISC_R_SUCCESS || result == ISC_R_NOPERM)
switch (result) {
case ISC_R_SUCCESS:
case ISC_R_NOPERM:
case ISC_R_DEFAULT:
return (result);
default:
break;
}
}
if (result == ISC_R_NOTIMPLEMENTED)

9
lib/dns/include/dns/dlz.h
View File

@@ -107,10 +107,11 @@ typedef isc_result_t
* the DNS server is performing a zone transfer query. The driver's
* method should return ISC_R_SUCCESS and a database pointer to the
* name server if the zone is supported by the database, and zone
* transfer is allowed. Otherwise it will return ISC_R_NOTFOUND if
* the zone is not supported by the database, or ISC_R_NOPERM if zone
* transfers are not allowed. If an error occurs it should return a
* result code indicating the type of error.
* transfer is allowed. If the view's transfer acl should be used,
* then the driver's method should return ISC_R_DEFAULT. Otherwise,
* it should return ISC_R_NOTFOUND if the zone is not supported by
* the database, or ISC_R_NOPERM if zone transfers are not allowed.
* If an error occurs, the result code should indicate the type of error.
*/
typedef isc_result_t

14
lib/dns/sdlz.c
View File

@@ -1610,17 +1610,23 @@ dns_sdlzallowzonexfr(void *driverarg, void *dbdata, isc_mem_t *mctx,
/* Call SDLZ driver's find zone method */
if (imp->methods->allowzonexfr != NULL) {
isc_result_t rresult = ISC_R_SUCCESS;
MAYBE_LOCK(imp);
result = imp->methods->allowzonexfr(imp->driverarg, dbdata,
namestr, clientstr);
MAYBE_UNLOCK(imp);
/*
* if zone is supported and transfers allowed build a 'bind'
* database driver
* if zone is supported and transfers are (or might be)
* allowed, build a 'bind' database driver
*/
if (result == ISC_R_SUCCESS)
result = dns_sdlzcreateDBP(mctx, driverarg, dbdata,
if (result == ISC_R_SUCCESS || result == ISC_R_DEFAULT) {
rresult = dns_sdlzcreateDBP(mctx, driverarg, dbdata,
name, rdclass, dbp);
}
if (rresult != ISC_R_SUCCESS) {
result = rresult;
}
return (result);
}

3
lib/isc/include/isc/result.h
View File

@@ -87,9 +87,10 @@
#define ISC_R_CRYPTOFAILURE 65 /*%< cryptography library failure */
#define ISC_R_DISCQUOTA 66 /*%< disc quota */
#define ISC_R_DISCFULL 67 /*%< disc full */
#define ISC_R_DEFAULT 68 /*%< default */
/*% Not a result code: the number of results. */
#define ISC_R_NRESULTS 68
#define ISC_R_NRESULTS 69
ISC_LANG_BEGINDECLS

2
lib/isc/result.c
View File

@@ -99,6 +99,7 @@ static const char *description[ISC_R_NRESULTS] = {
"crypto failure", /*%< 65 */
"disc quota", /*%< 66 */
"disc full", /*%< 67 */
"default", /*%< 68 */
};
static const char *identifier[ISC_R_NRESULTS] = {
@@ -170,6 +171,7 @@ static const char *identifier[ISC_R_NRESULTS] = {
"ISC_R_CRYPTOFAILURE",
"ISC_R_DISCQUOTA",
"ISC_R_DISCFULL",
"ISC_R_DEFAULT",
};
#define ISC_RESULT_RESULTSET 2

29
lib/ns/xfrout.c
View File

@@ -763,6 +763,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
bool is_poll = false;
bool is_dlz = false;
bool is_ixfr = false;
bool useviewacl = false;
uint32_t begin_serial = 0, current_serial;
switch (reqtype) {
@@ -826,7 +827,10 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
question_name,
&client->peeraddr,
&db);
if (result == ISC_R_DEFAULT) {
useviewacl = true;
result = ISC_R_SUCCESS;
}
if (result == ISC_R_NOPERM) {
char _buf1[DNS_NAME_FORMATSIZE];
char _buf2[DNS_RDATACLASS_FORMATSIZE];
@@ -843,9 +847,10 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
_buf1, _buf2);
goto failure;
}
if (result != ISC_R_SUCCESS)
if (result != ISC_R_SUCCESS) {
FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
question_name, question_class);
}
is_dlz = true;
} else {
/*
@@ -926,14 +931,21 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
"%s authority section OK", mnemonic);
/*
* If not a DLZ zone, decide whether to allow this transfer.
* If not a DLZ zone or we are falling back to the view's transfer
* ACL, decide whether to allow this transfer.
*/
if (!is_dlz) {
if (!is_dlz || useviewacl) {
dns_acl_t *acl;
ns_client_aclmsg("zone transfer", question_name, reqtype,
client->view->rdclass, msg, sizeof(msg));
CHECK(ns_client_checkacl(client, NULL, msg,
dns_zone_getxfracl(zone),
true, ISC_LOG_ERROR));
if (useviewacl) {
acl = client->view->transferacl;
} else {
acl = dns_zone_getxfracl(zone);
}
CHECK(ns_client_checkacl(client, NULL, msg, acl, true,
ISC_LOG_ERROR));
}
/*
@@ -958,8 +970,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
/*
* Get a dynamically allocated copy of the current SOA.
*/
if (is_dlz)
if (is_dlz) {
dns_db_currentversion(db, &ver);
}
CHECK(dns_db_createsoatuple(db, ver, mctx, DNS_DIFFOP_EXISTS,
&current_soa_tuple));